redundant decref on the eval stack value in LOAD_FROM_DICT_OR_DEREF in error path

[aisk]

Crash report

What happened?

With these codes bellow, a NameError will be raised as expected, but there will be a runtime crash when GC happens.

def xxx():
 class MyComplex:
 MyComplex

xxx()

Error logs:

Traceback (most recent call last):
 File "C:\Users\xxxxx\Source\cpython\a.py", line 71, in <module>
 xxx()
 File "C:\Users\xxxxx\Source\cpython\a.py", line 66, in xxx
 class MyComplex:
 File "C:\Users\xxxxx\Source\cpython\a.py", line 67, in MyComplex
 MyComplex
NameError: cannot access free variable 'MyComplex' where it is not associated with a value in enclosing scope. Did you mean: 'complex'?
C:\Users\xxxxx\Source\cpython\Objects\frameobject.c:889: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 00000150D0CDA990 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: finalizing (tstate=0x00007ffc567001f8)

Current thread 0x00003564 (most recent call first):
 <no Python frame>

CPython versions tested on:

3.12, CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-111654: remove redundant decref on the eval stack value #111655
• [3.12] gh-111654: remove redundant decref in LOAD_FROM_DICT_OR_DEREF (GH-111655) #111674

[JelleZijlstra]

Similar to #109118 and #109123. I'll take a look later today.

[aisk]

@JelleZijlstra Yes, I tried to figure it out from your PR #109123 as reference , I think it's the same issue in another OP code.

[terryjreedy]

I get the same crash in freshly compiled 'main', plus a few pages of garbage before 'Fatal Python error'. With released 3.13.0a1, the traceback but no crash.

[aisk]

@terryjreedy I get the same crash on v3.13.0a1, maybe there are some compile cache mechanisms?

[JelleZijlstra]

Errors due to use-after-free can be highly dependent on, well, lots of things, because memory may either get reused immediately or kept around, and you don't know what other objects get put in the same place later. It's not surprising that the same underlying bug that causes a use-after-free can manifest in wildly different ways.

[JelleZijlstra]

Thanks for the report and fix!